[SECURITY] Fedora EPEL 5 Update: clamav-0.98.7-1.el5

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-6081
2015-04-30 15:52:41
--------------------------------------------------------------------------------

Name        : clamav
Product     : Fedora EPEL 5
Version     : 0.98.7
Release     : 1.el5
URL         : http://www.clamav.net/
Summary     : Anti-virus software
Description :
Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of
this software is the integration with mail servers (attachment scanning).
The package provides a flexible and scalable multi-threaded daemon, a
command line scanner, and a tool for automatic updating via Internet.

The programs are based on a shared library distributed with the Clam
AntiVirus package, which you can use with your own software. Most
importantly, the virus database is kept up to date

--------------------------------------------------------------------------------
Update Information:

ClamAV 0.98.7
=============

This release contains new scanning features and bug fixes.

  - Improvements to PDF processing: decryption, escape sequence handling, and file property collection.
  - Scanning/analysis of additional Microsoft Office 2003 XML format.
  - Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.
  - Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222.
  - Fix false negatives on files within iso9660 containers. This issue was reported by Minzhuan Gong.
  - Fix a couple crashes on crafted upack packed file. Identified and patches supplied by Sebastian Andrzej Siewior.
  - Fix a crash during algorithmic detection on crafted PE file. Identified and patch supplied by Sebastian Andrzej Siewior.
  - Fix an infinite loop condition on a crafted "xz" archive file. This was reported by Dimitri Kirchner and Goulven Guiheux. CVE-2015-2668.
  - Fix compilation error after ./configure --disable-pthreads. Reported and fix suggested by John E. Krokes.
  - Apply upstream patch for possible heap overflow in Henry Spencer's regex library. CVE-2015-2305.
  - Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.
  - Fix segfault scanning certain HTML files. Reported with sample by Kai Risku.
  - Improve detections within xar/pkg files.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1217206 - CVE-2015-2221: clamav Infinite loop condition on crafted y0da cryptor file
        https://bugzilla.redhat.com/show_bug.cgi?id=1217206
  [ 2 ] Bug #1217207 - CVE-2015-2222 clamav: crash on crafted petite packed file
        https://bugzilla.redhat.com/show_bug.cgi?id=1217207
  [ 3 ] Bug #1217208 - CVE-2015-2668 clamav: Infinite loop condition on a crafted "xz" archive file
        https://bugzilla.redhat.com/show_bug.cgi?id=1217208
  [ 4 ] Bug #1217209 - CVE-2015-2170: clamav: Crash in upx decoder with crafted file
        https://bugzilla.redhat.com/show_bug.cgi?id=1217209
--------------------------------------------------------------------------------

This update can be installed with the "yum" update programs.  Use
su -c 'yum update clamav' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora EPEL GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------